🤖 AI Summary
This work addresses the absence of cryptographic evidence verifying that autonomous AI agents comply with authorization policies within specific execution contexts. To bridge this gap, the paper introduces a cryptographically verifiable authorization relation, denoted $R_{CVA}$, which structurally decouples identity, request, and execution context. It formally defines critical security properties—such as authorization soundness and policy binding—and enables verification while preserving the confidentiality of private attributes. The authors instantiate the core model through a zero-knowledge proof prototype built upon the Groth16 zk-SNARK framework, thereby providing the first practical demonstration of cryptographically verifiable agent authorization.
📝 Abstract
Autonomous AI agents increasingly execute actions, invoke tools, and operate on protected resources with limited human oversight. Existing authentication and authorization mechanisms establish identity and delegate authority, but do not inherently provide cryptographic evidence that a concrete request issued by a specific agent satisfies the applicable policy in a specific execution context. This paper hypothesizes that agent authorization can be formalized as a cryptographically verifiable relation, denoted $R_{CVA}$, that jointly binds an agent principal, a concrete authorization request, an execution context, and the satisfaction of an applicable policy, while selectively preserving the confidentiality of private authorization attributes. We introduce a preliminary formal abstraction for Cryptographically Verifiable Agent Authorization (CVA), define a compact set of candidate security properties including authorization soundness, principal binding, request binding, policy binding, and replay resistance, and provide an executable zero-knowledge proof of concept that instantiates selected elements of the model over a Groth16 zk-SNARK construction. We further identify and formalize the structural separation among identity binding, authorization-request binding, and runtime execution binding as a central open problem in the design of secure agentic systems (a distinction {not explicitly addressed by} current agentic security frameworks) and present a falsifiable research agenda for its resolution.